58 matches found
CVE-2026-74700
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
UBUNTU-CVE-2026-74700
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
EUVD-2026-64387
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700
CVE-2026-74700 is a race condition in the Linux kernel's net/sched cls_api subsystem, specifically in the tc_new_tfilter function. An unlocked classifier's request can prematurely decrement the reference count of a locked classifier's protocol object without holding rtnl_lock, leading to a use-af...
CVE-2026-74700: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
Linux Distros Unpatched Vulnerability : CVE-2026-74700
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099900)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099900 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak Whe...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100325)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100325 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak Whe...
AZL-93957 CVE-2026-64530 affecting package kernel for versions less than 6.6.145.2-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...
CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...
CVE-2026-43035: Use of Uninitialized Resource
In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak When building netlink messages, tcchainfillnode never initializes the tcminfo field of struct tcmsg. Since the allocation is not zeroed...
CVE-2023-54193: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the flowblockcb instances are already in the driver list because driver...
CVE-2025-21857
CVE-2025-21857 affects the Linux kernel net/sched code (cls_api). The root cause is error handling in tcf_exts_miss_cookie_base_alloc() calling xa_alloc_cyclic() that can return 1 (wraps successfully), which is treated as an error by tcf_exts_init_ex() and causes exts to be NULL. fl_change() the...
CVE-2025-21857
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...